Measuring Operational Risk Using Fuzzy Logic Modeling
September 2003
Fuzzy logic has been used for decades in the
engineering sciences to embed expert input into computer models for a broad
range of applications. This approach provides more information to help risk
managers effectively manage operational risks than the current qualitative approaches
for ranking risks.
by Samir
Shah
Tillinghast
This article is part of a series of articles on modeling operational risks.
The introductory article in the series is Measuring
and Managing Operational Risks (April 2002).
This article describes how fuzzy logic modeling techniques can be used to
assess operational risks. In most cases, there is not enough reliable data to
apply the statistical approaches that are commonly used for assessing market
risks. There is a greater reliance on expert input rather than historical data
to assess operational risks. Modeling techniques that can accommodate a combination
of data and expert input are better suited for modeling operational risks. Fuzzy
logic has been used for decades in the engineering sciences to embed expert
input into computer models for a broad range of applications. It offers a promising
alternative for measuring operational risks.
Many companies that are in the process of implementing ERM are assessing
operational risks using qualitative methods. The approaches are typically some
variation of creating a list of "Top 10" risks based on expert input. The "Top
10" lists are often developed at a low level in the organizational hierarchy
(e.g., department, region, or business unit) and consolidated at various levels
of the hierarchy to an ultimate corporate "Top 10" list. However, there is not
enough information gathered for each risk for managers to assess the relative
magnitude of the risks and their interaction across the enterprise. This makes
it difficult for managers to decide how much to spend on managing each risk.
There is also a possibility that major risks fall through the cracks simply
because in isolation within a department, region, or business unit they are
not deemed critical, when, in fact, their accumulation and interaction across
the enterprise raises the potential of significant losses.
The approach described here is to apply fuzzy logic modeling to assess a
risk on the "Top 10" list. The assessment provides a more thorough definition
of each risk and its interaction with other risks than the current methods.
This provides local risk managers a decision tool for managing risks within
their organizational unit. It also allows corporate risk managers clearer information
to more reliably distill local Top 10 lists to a corporate Top 10 list and appropriately
allocate investment to manage each risk.
The following describes the steps undertaken when adding a new risk to the
Top 10 list. These steps apply fuzzy logic techniques for developing a causal
model that relates the risk to its key drivers or indicators. The causal model
is then used to develop a distribution of losses based on expectations for the
levels of its key drivers. Once the causal model is developed, updating the
model for periodic reviews of the Top 10 list is relatively quick and simple.
| For clarification, each step in the
process is described through an example for modeling market conduct
risk. These illustrations are highlighted in yellow boxes immediately
following the description of each step. |
Step 1—Specify Key Risk Indicators
For each Top 10 risk, several key risk indicators (KRIs) are specified. A
KRI is an operational or financial variable that provides a reliable basis for
estimating the loss corresponding to the risk. A KRI can be a specific causal
variable or a proxy for the drivers of the loss attributed to a risk. Ideally,
KRIs should be chosen that are regularly measured on an ongoing basis so that
data can be easily gathered.
For market conduct risk, let’s assume that the following KRIs were
identified:
- Agent years of experience—assuming
that less experienced agents are more prone to errors and omissions.
- Product complexity (measured subjectively
on a scale of 1 to 10)—assuming that increased complexity leads
to misrepresentation or confusion about product features.
- Premium growth rate—assuming,
for example, that market conduct risk is higher during periods of
rapid growth or when the company is losing business due to competition
than during periods of nominal growth.
There may be other KRIs such as agent training, agent turnover and
commission rates. Although there are no limits to the number of KRIs
that can be used from a modeling perspective, for practical purposes
however, two to four KRIs should be sufficient to capture the major
drivers of each risk.
|
Step 2—Calibrate Fuzzy Representation of KRIs and Loss Amount
The essential advantage offered by fuzzy logic techniques is the use of linguistic
variables to represent KRIs and the loss amount corresponding to a risk. In
this step, linguistic descriptors such as High, Low, Medium, Small, Large, for
example, are assigned to a range of values for each KRI and the loss amount.
Since these descriptors will form the basis for capturing expert input on the
impact of KRIs on the loss amount, it is important to calibrate them to how
they are commonly interpreted by the experts providing input. Referring to a
variable as High, for example, should evoke the same understanding among the
experts. The calibration may vary by region so that "High" employee turnover
may mean different things in different regions.
Step
2 Figure
Step 3—Specify Impact of KRIs on Loss Amount
Having specified the risk and its KRIs, the logical next step is to specify
how the loss amount varies as a function of the KRIs. Experts provide fuzzy
rules in the form of if … then statements
that relate loss amounts to various levels of KRIs based on their knowledge
and experience.
For market conduct risk, some examples
of fuzzy rules are:
|
Rule 1: |
If |
Product Complexity |
is |
High or |
|
|
Years of Experience |
is |
Low, |
|
Then |
Loss Amount |
is |
High |
|
Rule 2: |
If |
Years of Experience |
is |
Low and |
|
|
[Growth Rate |
is |
High or Negative], |
|
Then |
Loss Amount |
is |
Very High |
|
Rule 3: |
... |
|
|
|
Once the rules are specified, a graphical representation of the expected
loss due to market conduct risk as a function of its KRIs is used to
validate the fuzzy model. The following 3-D view shows expected loss
as a function of Growth Rate and Product Complexity for example. Note
that the risk is more sensitive to years of experience only as the product
complexity increases.
|
Figure
2
The rules span all possible scenarios for combinations of KRI levels, thus
completely mapping the input space of KRIs to the output space of risk loss
amounts.
Step 4—Calculate Expected Loss Amount
Since the fuzzy rules cover all possible combinations of KRI levels, the
estimated loss amount can be calculated for the current levels of each KRI.
A fuzzy calculator applies the math based on the fuzzy rules to generate the
expected loss.
If for market conduct risk, the current
KRI levels are:
| Average Years of Experience |
= |
6.3 |
| Product Complexity (1-10 scales) |
= |
7 |
| Expected Growth Rate |
= |
4.5% |
then the expected loss is $44 million.
This is calculated by applying the fuzzy rules using a software-based
fuzzy calculator. The mathematical details are not shown in order to
focus on the concepts and the process; however, they are based on the
standard mathematics of fuzzy set theory widely used in the engineering
sciences.
|
Step 5—Calculate Distribution of Losses
A probability distribution of expected losses next year can be derived by
representing the KRIs as a probability distribution of their levels expected
next year. Since the KRIs are typically operational or financial variables,
an empirical distribution based on historical data can be developed for each
KRI. To the extent that historical data is not representative, professional
judgment is used to modify the distribution as appropriate. Applying the same
fuzzy rules-based calculation produces a distribution of the expected losses
that capture the uncertainty underlying the KRIs.
Figure
3
It’s important to note that steps 1 through 3, involving identification of
the KRIs, the calibration of the linguistic descriptors, and the specification
of the fuzzy rules, are undertaken only when the risk is first added to the
Top 10 list. On an ongoing basis, only the distribution of the KRIs needs to
be specified to reflect changes in the forecast and uncertainty. The fuzzy rules
should be reviewed and revised only if the interaction among the KRIs and their
impact on the risk changes significantly. Although there are several steps involved
in adding a new risk to the Top 10 list, the ongoing periodic review of the
risk is simple and quick.
Conclusion
The fuzzy logic approach provides more information to help risk managers
effectively manage operational risks than the current qualitative approaches
for ranking risks. For one, risks are quantified based on a combination of historical
data and expert input. Although the absolute measurement of each operational
risk is not as reliable as the measurement of market risks, the relative levels
of each risk provide useful information for determining the relative investment
in managing each risk.
For companies implementing Enterprise Risk Management (ERM), risk assessment
must also capture the portfolio effect. One of the biggest hurdles to implementing
ERM is determining the correlation among risks. The fuzzy logic approach described
here reflects the interaction among risks through the commonality of the underlying
KRIs. To the extent that multiple risks have one or more KRIs in common, the
approach explicitly recognizes the interaction among the risks. The correlation
of risks is an output of the process rather than an input. Thus the fuzzy logic
modeling works well within an ERM framework.
Opinions expressed in Expert Commentary articles are those of the author and are
not necessarily held by the author’s employer or IRMI. This article does not purport
to provide legal, accounting, or other professional advice or opinion. If such advice
is needed, consult with your attorney, accountant, or other qualified adviser.